Set the caller's pointer to NULL in the destroy functions - #2386
Open
karpovantonme wants to merge 2 commits into
Open
Set the caller's pointer to NULL in the destroy functions#2386karpovantonme wants to merge 2 commits into
karpovantonme wants to merge 2 commits into
Conversation
t8_stash_destroy and t8_cmesh_trees_destroy take a pointer to the caller's handle so they can clear it after freeing, and the header documents exactly that: "The pointer is set to NULL after the function call." Both assign to the parameter itself instead of dereferencing it, so the caller keeps a dangling pointer. This is not only theoretical. t8_cmesh_commit checks `cmesh->stash != nullptr` before destroying it, and again at t8_cmesh_commit.cxx:145 before reading `cmesh->stash->classes`, so the guard is written against a NULL that never arrives. t8_cmesh_bcast frees the stash and marks the cmesh committed while the cmesh stays alive. Signed-off-by: Anton Karpov <karpovantonme@gmail.com>
Signed-off-by: Anton Karpov <karpovantonme@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2387
t8_stash_destroyandt8_cmesh_trees_destroyboth take a pointer to the caller's handle so that they can clear it after freeing, and both headers say so:/** \param [in,out] trees The tree structure to be destroyed. Set to NULL on output. */Neither does it. Both assign to the parameter instead of dereferencing it:
So the caller is left holding a dangling pointer, and the whole reason for taking a double pointer is lost.
Why this is not only cosmetic
The callers are written as if the contract held.
t8_cmesh_commit.cxx:626guards the destroy on the handle being non-NULL:and line 145 of the same file reads through the same guard:
Since
cmesh->stashis never set to NULL, that second check passes on a freed pointer and dereferences it.t8_cmesh_helpers.cxx:263-264andt8_cmesh_readmshfile.cxx:1596readcmesh->stash->...as well.t8_cmesh_bcast(t8_cmesh.cxx:792) is the clearest case: it destroys the stash and setscmesh_out->committed = 1, and the cmesh keeps living with a danglingstash.In the teardown path (
t8_cmesh_destroy) the dangling pointer is harmless, since the cmesh is freed right after. It is the commit and bcast paths that matter.The change
Two characters, one in each function:
pstash = NULLbecomes*pstash = NULL,ptrees = nullptrbecomes*ptrees = nullptr. Nothing else touched.I have not added a regression test. The natural one would assert that
cmesh->stash == NULLafter commit, but I did not want to guess where it belongs in your test layout. Happy to add it if you point me at the right file.Found with a
cppcheck --enable=warningsweep oversrc/(uselessAssignmentPtrArgatt8_cmesh_stash.c:70andt8_cmesh_trees.cxx:1295), then traced through the callers by hand.Author file added as
doc/author_karpov.txtper CONTRIBUTING, and both commits are signed off.